HackBlue

Tools · Ethical OSINT and privacy self-defense · 02 / 17

An OSINT methodology: requirements, collection, analysis, and reporting

Use the intelligence cycle to keep research focused, record sources as you go, separate facts from assessments, and write findings that lead to action.

9 min read · practice only with authorization

The cycle

Start with requirements: the specific questions you need answered, such as “Which internet-facing services does our organization expose?” Plan which sources answer each question. Collect, recording each source with a timestamp and archive link. Process and analyze: deduplicate, verify, and judge reliability. Report findings with recommended actions. Feedback refines the next round.

Record as you go

Every finding needs its source URL, the time you saw it, and a capture such as a screenshot or an archived copy, because public pages change or disappear. A simple spreadsheet works; tools such as Hunchly automate capture of browser research.

Snippet
finding_id | question | finding | source_url | captured_at_utc | archive_link | confidence | notes
F-004 | Exposed services | Grafana login on dash.example.org | https://dash.example.org/login | 2026-11-02T10:40Z | https://web.archive.org/... | high | appears in crt.sh and responds 200

Lab: one question, end to end

Pick a single requirement for your own domain or a domain you are authorized to review, such as “Which subdomains exist and which respond on HTTPS?” Plan two sources (certificate transparency and DNS), collect, record each finding in the format above, verify each by resolving it, and write a three-sentence finding with a recommendation. Note how much faster the work is when the question is narrow.

Facts versus assessments

Separate what you observed (“the host returns a Grafana login page”) from what you infer (“this is probably the monitoring dashboard for production”). Use confidence levels such as high, moderate, and low, and say why. Clear separation makes reports more trustworthy and easier to act on.

Diagram

Intelligence cycle

  1. Requirements

    Specific questions that matter.

  2. Collection

    Planned sources; record URL, time, capture.

  3. Analysis

    Verify, deduplicate, judge reliability.

  4. Reporting

    Findings, confidence, and actions; feedback into requirements.

Check yourself

1. Which stage defines the questions research must answer?

2. Why capture or archive sources as you go?

3. Which statement is an assessment rather than an observation?